Condition keys and operator information

Available in Classic and VPC

You can learn about the items related to Condition settings provided by NAVER Cloud Platform.

Condition key/value

Condition key/value: Property information to be applied to the policy. Permission checks are performed by comparing the "key:value" set in the condition key with the "key:value" of the properties where the policy is performed.

Type	Condition key	Details	Value input	Value information path	Data type
Principal properties	ncp:principalName	User name of the action performer.	User name	Services > Management & Governance > Sub Account > Sub Accounts > Sub account details.	String
	ncp:principalId	Login ID of the action performer.	Login ID	Services > Management & Governance > Sub Account > Sub Accounts > Sub account details.	String
	ncp:principaluuid	ID no of the action performer.	ID	Services > Management & Governance > Sub Account > Sub Accounts > Sub account details.	String
	ncp:principalType	Type of the action performer.	Enter the corresponding value from the following: If the performer is a sub account, enter IamUser. If the performer is a role, enter IamRole.		String
	ncp:sourceIdentityId	Each role's target resource if the principalType is IamRole.	AccountRole: Role transitioned user's Sub Account ID. SSO Role: Role transitioned user's SSO user ID. Service Role: Role assigned service's resource information.	AccountRole: Services > Management & Governance > Sub Account > Sub Accounts > Sub account details > ID. SSO Role: Services > Management & Governance > Ncloud Single Sign-On > External IdP Login > Users > User details > ID. Service Role_Data Flow: Services > Management & Governance > Resource Manager > Service role connected Data Flow resource's NRN. Service Role_Datafence: Services > Management & Governance > Resource Manager > Service role connected Datafence resource's NRN. Service Role_External Access: Services > Management & Governance > Sub Account > External Access > Subject Activity details > Performer.	String
	ncp:sourceIdentityType	Each role's user type if the principalType is IamRole.	Enter the corresponding value from the following: If AccountRole, enter IamUser. If SSO Role, enter FederatedUser. If Server Role, enter Server. If Service Role, enter NcloudService.		String
Resource properties	ncp: resourceTag	Used to allow or deny user actions on resources with specific tags when performing actions where resource specification is available.	key:value		String
	ncp: requestTag	A tag that controls whether a tag is required and which types of tags can be assigned when performing tag-assignment actions.	key:value		String
	ncp: principalTag	Tags that control who can run the Action.	key:value		String
Request properties	ncp: currentTime	Date and time the action request was received.	ISO 8601 standard (YYYY-MM-DDThh:mm:ss+00:00).		Date
	ncp: epochTime	Date and time the action request was received.	Integer representing the number of seconds elapsed since 00:00:00 UTC on January 1, 1970.		Date

Condition operators

Operator: A string condition used to check the "key:value" set in the condition key during permission checks.

Type	Description	Note
StringEquals	String matches exactly (case-sensitive).	Returns true if at least 1 of the values specified in the OR condition matches when multiple values are included.
StringNotEquals	String mismatches (case-sensitive).	Returns true if none of the values specified in the NOR condition match when multiple values are included.
StringLike	String matches similarly (case-sensitive).	* Returns true if a string partially matches, including (multiple wildcard). Returns true if at least 1 of the values specified in the OR condition matches when multiple values are included.
StringNotLike	Matches similarly (case-sensitive).	* Returns true if a string partially matches, including (multiple wildcard). Returns true if none of the values specified in the NOR condition match when multiple values are included.
StringEqualsIgnoreCase	String matches (case-insensitive).	Returns true if at least 1 of the values specified in the OR condition matches when multiple values are included.
StringNotEqualsIgnoreCase	String mismatches (case-insensitive).	Returns true if none of the values specified in the NOR condition match when multiple values are included.
DateEquals	Matches a specific time.	Checks whether the time matches to the second.
DateNotEquals	Does not match a specific time.	Checks whether the time does not match to the second.
DateLessThan	Before a specific time.	Returns true if the action request time is earlier than the time defined in the policy.
DateLessThanEquals	At or before a specific time.	Returns true if the action request time is earlier than or equal to the time defined in the policy.
DateGreaterThan	After a specific time.	Returns true if the action request time is later than the time defined in the policy.
DateGreaterThanEquals	At or after a specific time.	Returns true if the action request time is later than or equal to the time defined in the policy.
Null	Checks whether the condition key exists.	Use True or False to indicate whether the condition key exists. True: The key is absent or its value is null. False: The key exists and its value is not null. Cannot be used with ~IfExists.

Type	Description	Note
~IfExists	Check the condition only if the key exists followed by the operator.	Returns true if it does not exist.